In the Linux kernel, the following vulnerability has been resolved:
mptcp: cope racing subflow creation in mptcprcvspace_adjust
Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs.
A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcpcleanuprbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones.
Explicitly check that the subflow is in a suitable state before invoking tcpcleanuprbuf().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53122.json",
"cna_assigner": "Linux"
}